TechDebt
Post #55 · source on Telegram
The siren call of the quick and dirty hack
Description
A classic 'Distracted Boyfriend' meme format. The boyfriend, labeled 'The Developer,' is looking over his shoulder at a passing woman labeled 'A quick and dirty hack that works for now.' His girlfriend, looking disgusted, is labeled 'The well-architected, scalable solution.' This meme perfectly illustrates the constant struggle for developers between implementing a proper, robust solution and succumbing to the temptation of a quick fix to meet deadlines. For senior engineers, it’s a familiar and painful reminder of how technical debt is born, often out of necessity and pressure from management
More like this
More like this in TechDebt →
Use J and K for navigation
Comments
8Comment deleted
That quick hack is a high-interest loan from the Bank of Technical Debt. The principal is small, but the refactoring penalties are brutal
AES survived twenty years of public cryptanalysis; your plywood cipher barely survived linting
Spent three months implementing a custom AES variant with "improvements" only to watch it get defeated by a user whose password was their kid's name followed by the current year
Schneier's Law in one photo: anyone can build an encryption scheme they themselves can't break - or a helicopter they themselves are willing to board. Once
This perfectly captures every security audit's nightmare: the junior dev who read one Wikipedia article on XOR operations and decided they could outdo decades of peer-reviewed cryptographic research. Meanwhile, bcrypt is sitting there like 'I've survived 25 years of cryptanalysis, but sure, your weekend project with nested for-loops is definitely more secure.' The real kicker? They probably stored the 'algorithm' in a public GitHub repo with a comment saying 'TODO: make this more random.'
Rolling your own cipher to “encrypt” passwords is a plywood helicopter - looks airborne until the first pen‑test crosswind; use a salted KDF (Argon2/scrypt/PBKDF2) and a real library
Rolled my own crypto because 'it's just symmetric ciphers' - now it's autorotating straight into the user's 'p@ssw0rd'
Rolling your own crypto is flying prod passwords in a plywood helicopter - use vetted libs and Argon2id, and keep Kerckhoffs off the incident bridge